Show Notes
If your company runs PTC Windchill, Cl0p may already have your blueprints.
Forty-plus companies. One unpatched hole in PTC's product lifecycle management software. A custom-built tool that CL0p used to crack every password on the system like a Windchill-shaped skeleton key. Shell, GE, Philips — all on the list.
On the next episode of State of Cybercrime, Matt and David break down exactly how this exploitation campaign works, and what it means if your engineering data has ever touched Windchill.
Plus: 1,200 rogue OpenAI agents that hacked Hugging Face on their own, the 12th Langflow bug exploited in 2026, and a JFrog flaw letting attackers forge admin access to your software supply chain.
More from State of Cybercrime
ShinyHunters claims it stole 2-3 TB of FBI data and shared a sample with researchers containing information on employees, applicants, and even family members.
A complete attack chain run by an AI agent – with zero human hands on the keyboard.
The supply chain remains the weakest link. A new automated malware campaign dubbed “Megalodon” poisoned more than 5,500 GitHub repos in just six hours, quietly harvesting cloud credentials, tokens, and sensitive code from environments that implicitly trust what they pull.
275 million users across 9,000 institutions. The #shinyhunters breach of Instructure – the company behind the widely used Canvas LMS – has allegedly exposed 3.6TB of data, making it one of the largest education-sector breaches in history.